Refuted findings 14
Candidates the review stage examined and rejected, kept for transparency.
Persistence
criticalRefutedmedium confidenceThe `midas init` CLI writes or merges a `midas` MCP server entry into the config files of several agent clients (with a backup) and installs a Claude Code SessionEnd hook that captures session turns into memory; this is the declared setup function but it is a control-plane write.
non-destructively (merge + backup)
Why it was refuted
Writing the MCP server entry into client configs, with a backup, is the declared purpose of `midas init`. The Claude hook is installed only behind an explicit --claude-hook flag. This is the declared core capability, not concealed persistence.
Persistence
criticalRefutedmedium confidencebuild_memory defaults to a persistent shared SQLite store at ~/.midas/memory.sqlite3 (creating the directory) even though the module docstring says the default is in-memory, so memories from all MCP clients silently persist on disk and are shared across clients.
db = os.path.expanduser("~/.midas/memory.sqlite3")Why it was refuted
Persistent shared storage is the core capability of a memory server and is disclosed in the code comment, with an override via MIDAS_MCP_DB. The stale docstring does not make the behavior concealed or harmful.
Data exfiltration
highRefutedmedium confidenceThe eval harness (eval/llm.py) hardcodes third-party LLM endpoints (opencode.ai, api.groq.com, openrouter.ai, api.mistral.ai) and posts benchmark questions and retrieved memory context to them, which is undeclared and contradicts the repo's 'no network / no telemetry / data never leaves your computer' claims; it is an opt-in judge tool using user-supplied API keys, not a hidden channel.
"https://opencode.ai/zen/go/v1"
Why it was refuted
The endpoints are in the optional LLM-judge eval harness. It is dev tooling that is not shipped in the installed wheel, runs only with --judge and uses the user's own provider keys. It is not part of the MCP server's memory path, and no source-to-sink chain from stored memory is shown.
Data exfiltration
highRefutedlow confidenceChatLLM creates an httpx client and POSTs prompts (including assembled memory context) to a dynamic base_url chosen from env-provided keys, contradicting the privacy claims that no memory data is transmitted; this is confined to the optional eval/judge path.
self._client = httpx.Client(timeout=120.0)
Why it was refuted
The httpx client is created only inside the optional --judge eval path. It sends eval prompts to the provider the user configured, not the user's stored memory, and no chain from the server's memory store is shown.
Data exfiltration
highRefutedlow confidenceEval-only script eval/summarization_ab.py POSTs conversation turns over HTTP to a configurable Ollama host (default localhost), while the repo claims no data ever leaves the machine; the network call is undeclared in the privacy claims, though it is local by default and part of an offline benchmark harness.
with urllib.request.urlopen(req, timeout=self.timeout) as resp:
Why it was refuted
This is an eval-only A/B script that defaults to a local Ollama host at localhost, so data stays on the machine. It is not part of the shipped server and sends nothing off-host by default.
Data exfiltration
highRefutedmedium confidenceThe opt-in HTTPDistiller (and OllamaDistiller) POSTs conversation text to a configurable host and can send an environment-variable API key as a Bearer token to any base_url, which contradicts the 'data never leaves your computer / no memory data transmitted over the network' claims, though it is documented as an explicit opt-in tier.
"Authorization": f"Bearer {self.api_key}"Why it was refuted
The served mcp_server.py never imports or constructs HTTPDistiller or OllamaDistiller. Its `distill` entry is a prompt that returns instruction text for the agent's own model and makes no network call. base_url, host and api_key come only from operator-side constructor arguments, so no agent-controlled chain reaches the Authorization header. The cloud tradeoff is stated in the class docstring, and the key is the wrapped service's own API key.
Persistence
highRefutedmedium confidenceOpt-in `midas init --claude-hook` writes a SessionEnd command hook into the user's ~/.claude/settings.json (with backup) that auto-captures user transcript turns into memory; this agent control-plane write is disclosed, but not covered by the 'local memory' safety claims.
matchers.append({"hooks": [hook_settings_block()]})Why it was refuted
The hook is opt-in via an explicit CLI command and writes a fixed command with merge, backup and a matching uninstall. It is documented in the module docstring, so it is a validated hook shim with safe cleanup. No agent instruction triggers it.
Persistence
highRefutedlow confidenceThe optional `midas init --claude-hook` writes a SessionEnd hook into the agent control-plane file ~/.claude/settings.json, which reads session transcripts and stores user turns into memory. This is not listed among the declared MCP tools, but it is documented, opt-in, and local-only.
`midas init --claude-hook` registers a SessionEnd hook in `~/.claude/settings.json`
Why it was refuted
This is the same opt-in, documented SessionEnd hook with backup and uninstall. It is a validated hook shim with safe cleanup, and the docstring declares it, so it is not concealed.
Persistence
highRefutedlow confidenceOpt-in `midas init --claude-hook` merges a SessionEnd hook into ~/.claude/settings.json that reads each session transcript and offers user turns to local memory; this is a disclosed agent control-plane write with backup, and no network sink is visible.
`midas init --claude-hook` registers a SessionEnd hook in `~/.claude/settings.json`
Why it was refuted
This is the same opt-in, documented hook shim with merge, backup and uninstall, and no network sink is shown. The user runs the CLI explicitly, and no instruction directs the agent to do so.
Destructive action
highRefutedlow confidenceThe forget_all MCP tool wipes the entire memory store with a single call and no confirmation or dry-run, which is a destructive capability, though it is declared, annotated destructiveHint=True, and fits a memory server's purpose.
_mem.store.clear()
Why it was refuted
forget_all is a declared memory-management tool, annotated destructiveHint=True, and clearing memory is core to the server. This is the declared-core-capability carve-out.
Destructive action
highRefutedlow confidenceThe forget_all MCP tool wipes the entire memory store in one call with no confirmation or dry-run, so an agent invocation can irreversibly delete all stored memories (consistent with the declared memory-management purpose).
mem.store.clear();
Why it was refuted
forget_all is a declared tool whose description states it clears all memories, which is the core capability of a memory server. Nothing is concealed or beyond its stated purpose.
Credential access
mediumRefutedlow confidenceload_dotenv in the eval harness reads the repo-root .env and loads all of its entries into os.environ (not just provider keys); undeclared but used only to supply API keys to the eval LLM client, with no observed exfiltration beyond the chosen provider's Authorization header.
os.environ.setdefault(key.strip(), val.strip())
Why it was refuted
The .env loader only populates os.environ with setdefault so the eval client can find the user's own provider keys. No sink for other .env entries is shown, so this is the carve-out for env API keys for the wrapped service in dev-only tooling.
Data exfiltration
mediumRefutedlow confidenceThe optional eval LLM client reads provider API keys from the environment or .env and POSTs benchmark context and questions with a Bearer token to third-party hosted LLM endpoints (opencode.ai, groq, openrouter, mistral), which conflicts with the 'no telemetry' claim; the data is eval-dataset content for the declared judge feature.
f"{self.base_url}/chat/completions", headers=headers, json=payloadWhy it was refuted
The Bearer-token POST is the standard OpenAI-compatible judge call. It uses the user-supplied key for the chosen provider, is opt-in through --judge, and lives in dev-only eval tooling.
Agent hijacking
mediumRefutedlow confidenceThe resume tool description tells the agent to use the returned context silently, which could suppress disclosure of injected memory content to the user.
use it silently, then work
Why it was refuted
'Use it silently' tells the agent not to narrate the prompt-ready context block. It does not instruct concealment of anything from the user or any action, and it is not a hijack.
